Blackbaud Data Breach: When a Vendor Holds Donor Data

Many people learned about Blackbaud only when a charity or school told them their details had been exposed. This is how a vendor breach reaches you.

By Siddharth ShankarUpdated October 11, 2026

If you have donated to a charity, a school or a hospital foundation, your details may sit in software you have never heard of. Blackbaud makes that kind of software. A 2020 breach, and the FTC's 2024 order about it, show how a vendor problem becomes yours.

What happened

The FTC says a hacker exploited weaknesses in Blackbaud's networks in early 2020 and remained undetected for three months. During that time the hacker removed unencrypted sensitive data belonging to Blackbaud's customers. The FTC says the data included the personal information of millions of consumers, including Social Security numbers and bank account numbers.

The FTC also says the company waited nearly two months to notify its customers about the breach, and alleges that Blackbaud misled consumers about the extent of the stolen data. The Commission voted 3-0-2 to finalize the order in May 2024.

What the order requires

The order directs Blackbaud to delete data it no longer needs, to stop misrepresenting its security and data retention practices, to maintain an information security program and a retention schedule, and to tell the FTC about future breaches. The FTC page mentions no monetary penalty.

Why vendor breaches are different

The usual advice after a breach assumes you chose the company. Here the people affected were donors and constituents of other organizations. A donor gave details to a charity, and the charity stored them with a vendor. That two-step chain makes it hard to know who is accountable and how long data is kept.

Retention is the part the order addresses directly. Data that is kept for years after it is needed gives attackers more to take. The case is a reminder that deleting what you no longer need is a security step, not just a tidy-up.

What was exposed

The FTC page lists Social Security numbers and bank account numbers as examples of what was removed. It describes the data as unencrypted, meaning it could be read directly if taken. It does not give an exact count of people or a full list of data fields, and we do not add one.

How it ended

This is an unhappy ending for individuals. The order imposes obligations on the company and describes no payment to affected consumers. People who learned their data was involved were left to protect themselves.

A timeline of the case

The hacker was inside Blackbaud's networks in early 2020 and remained undetected for three months. The FTC says the company then waited nearly two months to notify customers. The Commission finalized its order in May 2024, about four years after the breach.

For the people whose data was involved, the order offers no payment, only improved behavior from the company in the future. That lag is why the time to protect yourself is when you first receive a notice, not when a regulator finishes its work.

Key facts at a glance

• Breach window: early 2020, undetected for three months
• Data: unencrypted, including Social Security and bank account numbers
• Scale: millions of consumers, per the FTC
• Notification: the FTC says the company waited nearly two months
• Order: delete unneeded data, security program, retention schedule, breach notices
• Vote: 3-0-2

What donors and members can do

What the page does not say

The FTC page does not give the exact number of people affected or any penalty. For a UK case where a supplier's weak access controls led to a large fine, see the Advanced ransomware case.

Want to apply this to your own situation? These explain what each type of breached data means, how to tell a real breach notice from a phishing message and what to do after your email appears in a breach in plain language. You can also try our free email exposure check.